   ([keypair subject-dn extensions]
    {:pre  [(keypair? keypair)
            (valid-x500-name? subject-dn)
-           (sequential? extensions)]
+           (extension-list? extensions)]
     :post [(certificate-request? %)]}
    (CertificateAuthority/generateCertificateRequest
      keypair subject-dn extensions)))

       (not (nil? (:critical x)))
       (not (nil? (:value x)))))

(defn keypair?
  "Returns true if x is a keypair (see `generate-key-pair`)."
  [x]

          (instance? Date not-after)
          (valid-x500-name? subject-dn)
          (public-key? subject-pub-key)
          (extension-list? extensions)]
    :post [(certificate? %)]}
   (CertificateAuthority/signCertificate
     issuer-dn issuer-priv-key (biginteger serial) not-before not-after subject-dn
